HTTP: Microsoft Windows Metafile SetPalette Entries Heap Overflow

This signature detects Windows MetaFile (WMF) images being downloaded through HTTP. Malformed WMF files can trigger a known vulnerability in several Windows versions. WMF files are generally not sent over the Internet aside from publishing industries. Networks that routinely transfer WMF files should consider not including this signature in a security policy.

Extended Description

Microsoft Windows WMF graphics rendering engine is affected by a remote code execution vulnerability. The problem presents itself when a user views a malicious WMF formatted file, triggering the vulnerability when the engine attempts to parse the file. A malicious file can cause an integer overflow that may facilitate heap memory corruption and arbitrary code execution. Any code execution that occurs will be with SYSTEM privileges due to the nature of the affected engine. Successful exploitation can facilitate a remote compromise or local privilege escalation.

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_media_center_edition

References

BugTraq: 25302 15356

CVE: CVE-2007-3034

URL: http://www.microsoft.com/technet/security/Bulletin/MS05-053.mspx

Short Name

HTTP:STC:IMG:WMF-SETPALETTE

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Metafile SetPalette Entries Heap Overflow

Extended Description

Affected Products

References

Found a potential security threat?